Seamless data masking for PaaS based applications

• US 9,858,431 B2
• Filed: 11/01/2015
• Issued: 01/02/2018
• Est. Priority Date: 11/01/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Farkash, Ariel, Gokhman, Igor, Goldsteen, Abigail, Moffie, Micha
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US14/929,348
• Publication Number:
  US 20170124341A1
• Time in Patent Office: 793 Days
• Field of Search: 726 30
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

Methods, computing systems and computer program products implement embodiments of the present invention that include defining, for a data masking engine executing in a platform as a service (PaaS) based software environment, one or more data masking rules. Upon detecting, by the data masking engine, data processed by a software application executing within the PaaS based software environment and in accordance with a given data masking rule, the data masking engine can perform a data masking operation on the data.

Claims

1. A method, comprising:

providing a platform as a service (PaaS) software, including a plurality of software environments, on a computer;

deploying a software application in one of the software environments of the PaaS software;

executing a data masking engine in one of the software environments of the PaaS software, wherein the data masking engine monitors inbound or outbound traffic of the deployed software application, passing through endpoints of the software application, supplied by the PaaS software;

defining, for the data masking engine, one or more data masking rules;

detecting, by the data masking engine, data processed by the software application in accordance with a given data masking rule; and

performing, by the data masking engine, a data masking operation on the detected data in accordance with the given data masking rule.

2. The method according to claim 1, wherein the plurality of software environments comprise software containers.

3. The method according to claim 1, wherein the data masking operation is selected from a group consisting of masking the data and unmasking the data.

4. The method according to claim 1, wherein the data masking engine is executed in a first software environment, and the software application is deployed in a second software environment, different from the first software environment.

5. The method according to claim 4, wherein the data masking engine is executed in a first software container, and the software application is deployed in a second software container, different from the first software container.

6. The method according to claim 5, wherein the data masking engine masks traffic of a plurality of software applications deployed in a plurality of respective software containers.

7. The method according to claim 1, wherein the data masking engine and the software application are in a same software environment.

8. The method according to claim 1, wherein the data masking engine enforces one or more specific masking rules on traffic of a plurality of software applications.

9. An apparatus, comprising:

a memory configured to store code of a platform as a service (PaaS) software; and

a processor configured;

to run the code of the PaaS, to provide a PaaS including a plurality of software environments;

to deploy a software application in one of the software environments of the PaaS software;

to execute a data masking engine in one of the software environments of the PaaS software, wherein the data masking engine monitors inbound or outbound traffic of the deployed software application, passing through endpoints of the software application, supplied by the PaaS software;

to define, for the data masking engine, one or more data masking rules,

to detect data processed by the software application executing in accordance with a given data masking rule, and

to perform a data masking operation on the detected data in accordance with the given data masking rule.

10. The apparatus according to claim 9, wherein the plurality of software environments comprise software containers.

11. The apparatus according to claim 9, wherein the data masking operation is selected from a group consisting of masking the data and unmasking the data.

12. The apparatus according to claim 9, wherein the data masking engine is executed in a first software environment, and wherein the processor is configured to execute the software application in a second software environment, different from the first software environment.

13. A computer program product, the computer program product comprising:

a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code comprising;

computer readable program code configured to provide a platform as a service (PaaS) including a plurality of software environments, to deploy a software application in one of the software environments of the PaaS software, to execute a data masking engine in one of the software environments of the PaaS software, wherein the data masking engine monitors inbound or outbound traffic of the deployed software application, passing through endpoints of the software application, supplied by the PaaS software, and to define, for the data masking engine one or more data masking rules;

computer readable program code configured to detect, by the data masking engine, data processed by the software application executing in accordance with a given data masking rule; and

computer readable program code configured to perform, by the data masking engine, a data masking operation on the detected data in accordance with the given data masking rule.

14. The computer program product according to claim 13, wherein the plurality of software environments comprise software containers.

15. The computer program product according to claim 13, wherein the data masking operation is selected from a group consisting of masking the data and unmasking the data.

16. The computer program product according to claim 13, wherein the PaaS based software environment comprises a first PaaS based software environment, and comprising computer readable program code configured to execute the first software application in a second PaaS based software environment.